Validate Live Session Token

It should be noted that this step may be skipped for your final product, though it is essential during initial development stages to validate implementation.

After calculating our Live Session Token, the calculation may be validated through the following steps to re-calculate the lst_signature value retrieved from the /live_session_token endpoint. If the calculated value matches the return value, then we have a valid live session token. If the two do not match, there is an issue in your LST generation process.

Begin by converting the computed live session token value to a base64 decoded byte array.

Next, retrieve the UTF-8 byte array equivalent of our consumer key.

Create a new HMAC Sha1 object, using the decoded live session token as a key. We then hash our HMAC Sha1 object against our consumer key byte string.

Convert the resultant byte array to a hex string.

If our new hex string matches the received lst_signature value, then our computed_lst value may be used as the live_session_token in future requests. If the two are different, then there may be an issue in the live_session_token generation process.

1
# Generate hex-encoded str HMAC hash of consumer key bytestring.
2
# Hash key is base64-decoded LST bytestring, method is SHA1.
3
hex_str_hmac_hash_lst = HMAC.new(
4
    key=base64.b64decode(computed_lst),
5
    msg=consumer_key.encode("utf-8"),
6
    digestmod=SHA1,
7
).hexdigest()
8
9
# If our hex hash of our computed LST matches the LST signature received in response, we are successful.
10
if hex_str_hmac_hash_lst == lst_signature:
11
    live_session_token = computed_lst
12
    print("Live session token computation and validation successful.")
13
    print(f"LST: {live_session_token}; expires: {datetime.fromtimestamp(lst_expiration/1000)}\n")
14
else:
15
    print(f"ERROR: LST validation failed.")